[Other]: CRA compliance

Update on this one. PR #1012 is open and covers both halves of the request.

SBOM: every published server image gets a CycloneDX SBOM, and every release publishes one alongside the binaries. There are two of them, because neither is complete on its own. The image scan covers the Alpine base packages and the Go module graphs. It cannot see the npm tree, because the web interface is bundled by Vite and then compiled into the Go binary, so there is no npm metadata left in the image for a scanner to find. The second SBOM is generated from the source tree and covers that.

Build provenance: signed SLSA provenance attestations bound to the image digest and stored as OCI referrers, attached to the published images. Release binaries get a provenance attestation as well, plus a SHA256SUMS file. Until now there was no way at all to verify a downloaded binary offline, so that part was overdue regardless of this request.

On your tooling note: we are using Syft for the SBOMs. For signing we went with Sigstore attestations rather than calling cosign directly. Same trust root and the same transparency log, so it is not a proprietary format, but in practice verification is easiest with the GitHub CLI. If a cosign signature would fit your pipeline better, say so and we will add one alongside. It is a small change.

Verification instructions are going into the operator guide: how to verify an image or a binary, and where to get the SBOM.

One gap worth flagging rather than letting you find it: the SCAP policy content used for compliance scanning is downloaded from the ComplianceAsCode project during the image build. It is data files with no package metadata, so no scanner catalogues it. The version is pinned per build.

On the CRA framing in the title: we are treating the SBOM as the Annex I Part II requirement it is, and the provenance attestation as good practice rather than something the regulation actually mandates. The wider CRA obligations, including the reporting duties that begin in September, are separate work that this change does not close out. We will retitle this post to the SBOM and provenance scope so it does not read as a claim to be CRA compliant overall.

This will be marked complete when it ships in a release, not when the PR merges.

Iby

Available tools : cosign to sign the binary without vendor lock.
Syft for generate SBOM from binary/docker image.